A county auditor reviews high-risk AI go-lives. What evidence best demonstrates decision rights?
Select an answer to reveal the explanation.
Short Explanation
Auditors don’t take “trust me, we approved it” as evidence. They want decision logs—names, dates, who green-lit each high-risk go-live.
Full Explanation
County auditors looking for decision rights evidence need decision logs that show who approved each high-risk AI go-live—name, role, date, scope, and any conditions or exceptions attached to the authorization. Those logs demonstrate that municipal authority was exercised, not merely assumed, and they support reconstruction if the system later harms residents or fails controls. High-risk go-lives without such logs leave governance claims without proof and weaken both internal audit and external oversight of county AI.
Verbal claims that “someone somewhere approved it” fail audit standards because unverifiable oral history is not evidence of decision rights. A blank folder labeled approvals with no names or dates fails by concept: empty containers simulate process without substance and cannot identify the accountable official. Only vendor marketing emails with no county approver fail because vendor enthusiasm is not county decision authority and does not establish who inside government authorized production use.
Exam caveat: decision logs can live in ticketing, GRC, or board systems, but they must identify the municipal approver and the specific system or release; screenshots of vendor decks are not substitutes for approval records. Operational check: for each high-risk AI go-live in the period under review, produce the approval record with named county authority, and flag any production system lacking that evidence as a formal governance finding.